Overview

The CA Policies tab lists every Conditional Access policy configured in your client's Microsoft Entra ID tenant. Use it to understand the access rules in place and spot gaps in access control.

How It Works

Policy table

Each policy shows:

• Priority — the policy's evaluation order
• Rule Name — descriptive name of the policy
• Action — the enforced action, color-coded by type:
  • REQUIRE MFA — requires multi-factor authentication
  • DENY — blocks access entirely
  • COMPLIANT DEVICE — requires a compliant or managed device
• Status — whether the policy is enabled or disabled
• Source (Users) — the users or groups the policy targets (e.g., "All", specific groups)
• Destination (Apps) — the applications the policy applies to
• Conditions — additional conditions such as device platforms or locations
• Risk / Impact — risk level (High, Medium, Low) and the scope of affected users

Tools on the tab

• Search and filter — search across policies, users, apps, and conditions
• Export CSV — download the full policy list for offline review or reporting
• Refresh Data — pull the latest policies from Microsoft Entra ID
• Snapshot timestamp — shows when the data was last fetched, so you know how current it is

Best Practices

• Check the Snapshot timestamp before reviewing; click Refresh Data if the client changed policies recently.
• Before changing or remediating sign-in policies, confirm break glass accounts are excluded. See Break Glass Accounts and Lockout Risk.

Related Articles

• Break Glass Accounts and Lockout Risk
• Users Posture
• Drift Detection